CVE-2026-73660

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.6 FreePBX versions prior to 17.0.5.4

Description The Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage and decoded during dialplan generation. This name is passed as an AGI (Asterisk Gateway Interface) argument and used to build filenames within agi-bin/propolys-tts.agi. Because the destination name reaches a raw shell-command execution path, it enables arbitrary operating-system command execution with the privileges of the asterisk service user.

Recommendations Update to version 16.0.6. Update to version 17.0.5.4.